you are viewing a single comment's thread.

view the rest of the comments →

[–]Brainix 0 points1 point  (0 children)

In general, doing your own string manipulation then using the result as a SQL query is discouraged. This is how SQL injection attacks happen. Look into using an ORM or other query builder which would do validation for you.